Configuring and Enabling VLAN Subinterfaces and 8021Q Trunking

This section describes how to configure and enable a VLAN subinterface. An interface with one or more VLAN subinterfaces is automatically configured as an 802.1Q trunk.

You must enable the physical interface before any traffic can pass through an enabled subinterface (see the "Configuring and Enabling RJ-45 Interfaces" section on page 5-1 or the "Configuring and Enabling Fiber Interfaces" section on page 5-2). For multiple context mode, if you allocate a subinterface to a context, the interfaces are enabled by default in the context. However, before traffic can pass through the context interface, you must also enable the interface in the system configuration with this procedure.

Subinterfaces let you divide a physical interface into multiple logical interfaces that are tagged with different VLAN IDs. Because VLANs allow you to keep traffic separate on a given physical interface, you can increase the number of interfaces available to your network without adding additional physical interfaces or security appliances. This feature is particularly useful in multiple context mode so you can assign unique interfaces to each context.

To determine how many subinterfaces are allowed for your platform, see Appendix A, "Feature Licenses and Specifications."

Note If you use subinterfaces, you typically do not also want the physical interface to pass traffic, because the physical interface passes untagged packets. Because the physical interface must be enabled for the subinterface to pass traffic, ensure that the physical interface does not pass traffic by leaving out the nameif command. If you want to let the physical interface pass untagged packets, you can configure the nameif command as usual. See the "Configuring Interface Parameters" section on page 7-1 for more information about completing the interface configuration.

To add a subinterface and assign a VLAN to it, perform the following steps:

Step 1 To specify the new subinterface, enter the following command:

hostname(config)# interface physical_interface.subinterface

See the "Configuring and Enabling RJ-45 Interfaces" section for a description of the physical interface ID.

The subinterface ID is an integer between 1 and 4294967293. For example, enter the following command:

hostname(config)# interface gigabitethernet0/1.100

Step 2 To specify the VLAN for the subinterface, enter the following command:

hostname(config-subif)# vlan vlan_id

The vlan_id is an integer between 1 and 4094. Some VLAN IDs might be reserved on connected switches, so check the switch documentation for more information.

You can only assign a single VLAN to a subinterface, and not to the physical interface. Each subinterface must have a VLAN ID before it can pass traffic. To change a VLAN ID, you do not need to remove the old VLAN ID with the no option; you can enter the vlan command with a different VLAN ID, and the security appliance changes the old ID.

Step 3 To enable the subinterface, enter the following command:

hostname(config-subif)# no shutdown

To disable the interface, enter the shutdown command. If you shut down an interface in the system execution space, then that interface is shut down in all contexts that share it.

Continue reading here: Security Level Overview

Was this article helpful?

0 0